The Windows Registry is a hierarchical database in which Windows and applications store configuration settings for the system, hardware, software and user accounts.
How the Windows Registry works
The registry is organised into keys and values, similar to folders and files. Its main root keys include HKEY_LOCAL_MACHINE (HKLM) for system-wide settings and HKEY_CURRENT_USER (HKCU) for the logged-on user. On disk the data is kept in hive files: SAM, SYSTEM, SOFTWARE and SECURITY in %SystemRoot%\System32\config, and NTUSER.DAT in each user profile. Administrators view and edit it with the Registry Editor (regedit), the reg command or PowerShell.
Why the registry matters for security
Because the registry controls what Windows starts and how it behaves, attackers abuse it constantly:
- Persistence – adding entries to Run and RunOnce keys or registering services makes malware start at every boot (MITRE ATT&CK T1547.001). This is one of the most common forms of persistence.
- Fileless storage – families such as Poweliks and Kovter hid their code inside registry values instead of files, a classic fileless malware technique.
- Weakening defences – changing values to disable Microsoft Defender, UAC or logging (T1112, Modify Registry).
- Credential theft – saving the SAM and SYSTEM hives (T1003.002) yields local password hashes for pass-the-hash attacks.
For investigators, the registry is a rich source of forensic artefacts: recently run programs, connected USB devices and user activity.
How to protect the registry
- Limit administrative rights so ordinary users and malware cannot change HKLM.
- Monitor autostart keys with Sysmon (event IDs 12–14) or EDR, and review them with tools such as Autoruns.
- Enable tamper protection to stop malware from changing security settings.
